Please report a vulnerability in private. Use the Report a vulnerability button on the Security tab of this repo, or write to contact@aivory.net. Do not open a public issue.

Tell me what you found and how to repeat it. Do not paste the content of a real agent session. I answer within a few days, and I credit you in the fix if you want that.

Only the newest release gets security fixes.

Theme packages are untrusted input. A theme that escapes the rules in ADR 0024 section 8 is a security bug.